When you run smbd -V on your Snow Leopard installation, you'll see it's running SAMBA version 3.0.28a-apple. While I'm not sure how much difference the "-apple" makes, version 3.0.28a is old. Very old. In other words, it's riddled with bugs. Apple hasn't updated SAMBA in 3 years, and for Lion, they're dumping it altogether for something homegrown. The reason? SAMBA is now GPLv3.

-Actually, Netatalk uses its own set of authentication plugins that work independently of the surrounding architecture.

Netatalk kan use Kerberos for authentication with just a singe requirement met: The Kerberos keytab (e.g. /etc/krb5.keytab) needs to contain a service principal key for use with Netatalk. This is usually called afpserver/yourserver.example.org@EXAMPLE.ORG .

Basically, this tells Netatalk to bind to all interfaces, use TCP protocol, use GSSAPI (Kerberos5) for authentication, using the newly created afpserver service principal key from the system's Kerberos keytab and present to others a service of the type afpserver, identifying itself as yourserver.example.org within the realm EXAMPLE.ORG running AFP on port 548